The answer is now in the article: "If the goal was, as I suspect, to use the same AES core for everything, then a Davies-Meyer construction around AES (which is

The answer is now in the article: "If the goal was, as I suspect, to use the same AES core for everything, then a Davies-Meyer construction around AES (which is about the same amount of code as the CBC-MAC is) would’ve worked too, although" Mega has to include the lengthy JS AES code anyway and did not want to add more files just for MD5 or SHAx. By building a mac/hmac on AES they save code size